auth.log?

[WizardStan]

slaeshjag's thread got me curious about what would happen if someone were to attempt to hack my Pandora. Not worried, just idle curiosity.


Idle curiosity that quickly turned to worry. There's no auth.log file. No record of any kind about who is coming and going that I can find. The syslog.conf is not a format I recognize. What's going on here? Anyone have any ideas?

 

[Mash]

Anyone have any ideas?

As far as i can comment on it, it seems that all log-files are redirected to one file: /var/log/slim.log.


If you are concerned about running services, just run something like "nmap" against your Pandora, and you'll see only one open tcp-port (assumed you're not running additional services like "dropbear"): 6000.


This port is opened by Pandora's X-server to allow connections from remote login-managers, so i disabled it. To disable it, just add a line (as root, or use sudo) to /etc/slim.conf:

  xserver_arguments   -nolisten tcp

Restart your Pandora and now all ports are closed, so no more need to worry.

 

[WizardStan]

I'm not worried about the open ports, it's the fact that there doesn't seem to be any log of attempts to access those open ports anywhere, at least not in anything I'm familiar with on my desktop.


Dropbear is disabled unless I'm using it, and I'm behind a hardware firewall anyway, so I'm not actually worried, it's just the unfamiliarity of the missing log file. There should be something, and it bothers me that there isn't, even if I don't actually need it or anything like that.


I could be wrong, but slim.log appears to only be the local login manager log file; I can see logs from when I booted, but nothing about ssh attempts.

 

[Mash]

I can see logs from when I booted, but nothing about ssh attempts.

That's by design, because on the Pandora syslog(-ng) isn't running. Services on Linux use syslog (or a derivate) to log different facilities from running services. But only running syslog isn't enough: as long as you are not running services like sshd/dropbear, there's nothing that will be logged at all.


To log _everything_ on network-level, you have to do some iptables-magic or install some special service like tcpwrapper/tcpspy.